Healthcare teams email every day: referrals, scheduling, billing, results. HIPAA doesn't forbid that. It asks you to protect the information sensibly and to document your choices.
Is email allowed at all?
Yes. HHS guidance says covered providers may communicate with patients by email if they apply reasonable safeguards, for example checking the address before sending and limiting the amount and type of information in unencrypted messages.
The safeguards that matter for email
The HIPAA Security Rule's technical safeguards map neatly onto email:
| Safeguard | What it means for email | How a gateway can help |
|---|---|---|
| Access control | Only the right people can reach ePHI. | Administrator roles and MFA; recipients verified with a one-time code (Secure Message Professional). |
| Audit controls | Record and examine activity. | An audit log of every configuration change and a mail flow log of message events. |
| Integrity | Protect ePHI from improper alteration. | Authenticated encryption at rest; DKIM checks on inbound mail. |
| Person or entity authentication | Verify who's accessing information. | One-time codes sent to the original recipient; administrator MFA and SSO. |
| Transmission security | Guard ePHI moving over networks. | TLS for web and SMTP, per-domain TLS enforcement, and portal delivery for sensitive messages. |
Is encryption required?
Under the Security Rule, encryption for data in transit is an addressable specification: you assess whether it's reasonable and appropriate, choose a solution, and document the decision. In practice, most organizations decide that sensitive messages to outside recipients need more than an ordinary send.
Plain-English version: you don't have to encrypt every email, but you do have to think it through, pick sensible protections, and write down why.
Patient preferences
Patients can ask to be contacted by reasonable alternative means. If a patient finds unencrypted email unacceptable, HHS says providers should offer other options, such as a more secure electronic method. If a patient starts an email exchange, providers may generally assume email is acceptable unless the patient says otherwise.
Vendors and agreements
When a vendor creates, receives, maintains or transmits PHI on your behalf, you'll typically need a business associate agreement. With a self-hosted gateway, the message store runs on your infrastructure. Still, review every service in your mail path, including your mail provider, and any hosted AI provider you choose to enable.
A practical checklist
- Write down how your organization uses email for PHI, and who sends it.
- Decide which messages need extra protection, and how staff trigger it.
- Turn on sender authentication checks (SPF, DKIM, DMARC) for inbound mail.
- Require MFA for anyone administering email security.
- Keep audit logs and know how long you retain them.
- Back up encryption keys securely and off-host.
- Train staff to verify addresses and spot phishing.
- Review the setup at least once a year.
Where Secure Message fits
Secure Message is built to support these safeguards, not to certify you. Community filters inbound mail and checks SPF, DKIM and DMARC. Professional adds the one-time-code recipient portal for sensitive outbound messages. Everything runs on a host you control, with encryption at rest under your key. There's no official HIPAA certification for an email product, and compliance depends on how you configure and operate it.